Use LMS as codejail service for CMS

[timmc-edx]

A/C:

• Implement https://github.com/eduNEXT/codejailservice API in LMS (possibly as plugin)
  • New plugin app: feat: Add codejail_service app for transition to containerized codejail edx/edx-arch-experiments#530
• Change CMS to call LMS view instead of running codejail calls internally
  • Code change to allow remote_exec to make authenticated calls: feat: Support sending OAuth token to codejail service #34023
• Deploy
  • Stage
    • Deploy plugin to LMS: https://github.com/edx/edx-internal/pull/10076
    • Configure CMS
  • Prod
    • Deploy plugin to LMS
    • Configure CMS
  • Edge
    • Deploy plugin to LMS
    • Configure CMS
  • Sandboxes
    • Deploy plugin to LMS
    • Configure CMS

As a step towards moving codejail to its own service and containerizing edxapp, we could move to an intermediate approach where the LMS runs codejail executions on behalf of CMS. This would provide the following benefits:

• CMS could be containerized independently of LMS (no need to do both at the same time).
• We would exercise the remote-codejail pathway and have an opportunity to discover and implement needed improvements before fully building out a separate codejail service.

This would entail adding a new view in LMS and configuring CMS to call it, as well as adding some authorization code.

Implementation details:

• "Send this to a remote codejail" is already implemented in xmodule/capa/safe_exec/remote_exec.py
• Ideally, we should keep the request/response format and the path the same so that we don't need to add yet another remote-codejail code path or use an intermediary (API Gateway?) to adjust the request.
• The new view needs to require authorization, particularly since execution parameters like unsafely are in play. We can adjust remote_exec.py to add a token on behalf of the cms service user.
• Regardless of authorization, LMS should ignore the unsafely request parameter unless a new Django setting (maybe CODEJAIL_SERVICE_ALLOW_UNSAFE) is set to True. To my knowledge, 2U does not allow unsandboxed codejail execution. Any deployer who wants to allow this will need to explicitly opt in to this dangerous setting.